Privacy Policy

Who this policy covers, and our role

Two kinds of people show up in WrapForce. First, shop staff who create an account and log in - for their account data we decide how the data is used, so we are responsible for it directly. Second, a shop's own customers (and website visitors), whose details a shop enters or who submit a lead through the shop's website or view a quote we host. For that customer data the shop is in charge and we act only as its service provider, processing the data on the shop's behalf and under its instructions. If you are a shop's customer with a question about your data, contact the shop first; we will help them respond.

What we collect

• Account data. Name, email, phone, and a password (stored only as a secure hash, never in plain text) for the staff who sign up and log in.
• Workspace data your shop enters. Customers (name, email, phone, address, notes), vehicles (make, model, VIN), leads, quotes, jobs, inventory, scheduling and calendar entries, and photos you upload.
• Lead-widget submissions. If a shop embeds our quote widget on its own website, we receive the contact details and vehicle/photo information a visitor submits. To keep the widget free of spam and abuse we process a one-way hashed version of the visitor's IP address and a Cloudflare Turnstile bot-check signal.
• Public quote and deposit activity. When a shop shares a quote link, we record that the quote was viewed and, if a deposit is paid, the payment metadata returned by Stripe (amount, status, and a token - never full card numbers).
• Technical and diagnostic data. Standard server logs (IP address, browser and device type, timestamps) and error reports (including stack traces and the context around a crash) that we use for security, debugging, and keeping the service reliable.
• Cookies and analytics. We use a small number of strictly necessary cookies to keep you signed in and secure. For traffic measurement on our marketing site we use Cloudflare Web Analytics, which is privacy-first and cookieless - it does not track you across sites or build an advertising profile. We do not use third-party advertising or cross-site tracking cookies.

How we use it

To run the product you signed up for: storing your workspace data, generating AI mockups from photos you upload, answering your questions through the in-app AI assistant, decoding VINs, processing customer deposits through your own Stripe account, sending the transactional emails and text messages you'd expect (invites, receipts, appointment and quote notifications), preventing fraud and abuse, providing support, and diagnosing and fixing problems. We do not sell your data or your customers' data, and we do not use it for third-party advertising.

AI mockups

When you generate a mockup, we send the photo and the structured spec you chose (such as colour and finish) to Google and OpenAI, which return a rendered image. Only what you submit for that render is shared - not your full workspace, your customer list, or anything else. We use these providers' business/API tiers, under which the content you submit is not used to train their general-purpose models.

Vehicle identification numbers

VINs you enter are encrypted at the application level before storage and are only decrypted when an owner or manager explicitly asks to view one; every reveal is logged. When you use VIN decoding, the VIN is sent to the U.S. National Highway Traffic Safety Administration's public vPIC service to look up vehicle details.

SMS/text messaging

If you consent to receive text messages, we send transactional SMS notifications - quote delivery, appointment reminders and confirmations, and vehicle status updates - from the wrap shop you are working with, sent via WrapForce (delivered through Twilio). Shop staff who opt in also receive new lead and booking alerts for their business. Consent is collected through an opt-in checkbox on a WrapForce-powered form, or verbally when you request service from a shop, after which shop staff record your details in WrapForce with your consent. Consent is never a condition of purchase. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP to any message, or reply HELP for assistance.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use-case categories exclude text messaging originator opt-in data and consent; this information will not be shared with, or sold to, any third parties.

Email

We send transactional email that is part of using the service - account and workspace emails, receipts, and the appointment and quote notifications a shop turns on. Any marketing or promotional messages are sent only with consent, in line with Canada's Anti-Spam Legislation (CASL), and you can unsubscribe at any time. If a shop uses WrapForce to message its own customers, the shop is responsible for having the consent to do so.

Who we share it with

We do not sell personal information. We share it only with the service providers ("sub-processors") we rely on to run WrapForce, each of which is bound to use it only for the services they provide to us:

• Supabase - database hosting and authentication.
• Cloudflare - file/photo storage (R2), content delivery and hosting, cookieless web analytics, and Turnstile bot protection.
• Stripe - subscription billing, and Stripe Connect for processing your customers' deposits into your own Stripe account.
• Resend - delivery of transactional email.
• Twilio - delivery of text messages.
• Google and OpenAI - AI mockup generation (processing only the photo and spec you submit for a render).
• Anthropic - powers the in-app AI assistant, processing the messages you type to it and the workspace records (leads, customers, vehicles, quotes, jobs, and inventory) it reads to answer them.
• NHTSA vPIC - VIN decoding via a public U.S. government service.
• Sentry - error monitoring and crash diagnostics.

We may also disclose information if required by law, or to protect the rights, safety, and security of WrapForce, our users, or the public. If WrapForce is ever transferred to another owner, your data would move with it under this same policy.

Where your data is stored

WrapForce is operated from Canada, and our providers store and process data primarily in North America and, in some cases, other regions where they operate. Wherever data is processed, it is protected by this policy and by the contractual safeguards we have with each provider.

How long we keep it

We keep workspace data for as long as your account is active. When you delete a workspace, its data is permanently removed from our live systems and then rotates out of encrypted backups on a rolling basis. Technical logs and error diagnostics are kept only for a limited period for security and troubleshooting. We may retain the minimum needed to meet legal, tax, or accounting obligations.

How we protect it

Data is encrypted in transit (HTTPS) and at rest. VINs get an additional layer of application-level encryption. Access to a workspace's data is restricted to that workspace through database-level row security, sensitive actions such as VIN reveals are audit-logged, and access to our production systems is limited to what is necessary to operate them. No system is perfectly secure, but we work to protect your information and will notify you and any required authorities of a breach affecting personal data as the law requires.

Your rights and choices

You can opt out of SMS at any time by replying STOP to any message. You can export or delete your workspace data at any time from Settings, and deleting a workspace permanently removes its data. Depending on where you live, you have the right to access the personal information we hold about you, to correct it, to have it deleted, to receive a portable copy, and to withdraw consent or object to certain uses. Because we do not sell personal information, there is nothing to opt out of on that front. To exercise any of these rights over account data, contact us at [email protected]. If your data lives in a shop's workspace, contact the shop, which controls that data; we will support the shop in responding.

Children

WrapForce is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this policy as WrapForce evolves. When we do, we'll change the "last updated" date above, and for significant changes we'll give notice in the app or by email. Continuing to use WrapForce after an update means you accept the revised policy.

Contact

Questions or requests about your privacy: [email protected].